Sponsored Content
Special Forums Cybersecurity Last 24 hours of /var/mail/root/ Post 302374509 by unSpawn on Tuesday 24th of November 2009 05:37:50 PM
Old 11-24-2009
AFAIK this is not a Linux Security forum question but OK. /var/spool/mail contents are basically plain text files (mbox format) so egrepping for ^Date (as in `date +'%a, %d %b %Y'`) and ^Subject could help narrow things down. Shouldn't be too hard to script.
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Unix IMAP e-mail via Outlook showing +10 hours

Multiple users at my work are connecting to a UNIX IMAP e- mail server via Outlook 2003 that is creating a small problem. Random new e-mails repeat themselves up to 3 times with an additional 10 hours added to them of when the original arrived. i.e Original e-mail marked arrived at 10:00am... (2 Replies)
Discussion started by: arkady
2 Replies

2. Shell Programming and Scripting

READING mail from /var/mail/user

Hello guys, I'm in desperate need. I need to write a script that behaves like a "mail" shell program. I've a base of the program -menu and so on, but what I cannot do is how to read messages from /var/mail/user. I would like to separate them as "mail" program does, but I;m just a newbie and... (21 Replies)
Discussion started by: petoSVK
21 Replies

3. UNIX for Dummies Questions & Answers

Can I zero var/spool/mail/mail

The mail file in the directory var/spool/mail is very large. Can I zero this (>) without losing any unopened mails there may be? There are about 10 mail accounts. Using RedHat Linux. Thanks in advance. (0 Replies)
Discussion started by: dennisheazle
0 Replies

4. Solaris

how to forward mail in /var/mail/username to external mail

Dear All, Now I use solaris 10 and I try to forward mail from /var/mail/username to their external mail so what should I do? thank u in advance (2 Replies)
Discussion started by: unitipon
2 Replies

5. UNIX for Dummies Questions & Answers

How do I read mail in /var/spool/mail?

How can I read mail sent to /var/spool/mail? I do not have pine installed so forget about that...is there some generic utility I can use? (3 Replies)
Discussion started by: mojoman
3 Replies

6. UNIX for Dummies Questions & Answers

/var/spool/mail

Hi, How can i get my mail on either /var/spool/mail or /var/mail? I use mail and sendmail command to send mail. But everytime I send mail it comes to my outlook inbox and when I check with mail command I get the message "No mail for siba". (Note siba is my user Id.) (2 Replies)
Discussion started by: siba.s.nayak
2 Replies

7. UNIX for Dummies Questions & Answers

Parse /var/mail

Hi all... We have a box that receives a lot of incoming emails. I have a .procmailrc file that in turn invokes a python script, which process each of these incoming email. All is nice and good. However, before the .procmailrc and python script were in place, we still were receiving emails and... (0 Replies)
Discussion started by: khader69
0 Replies

8. Shell Programming and Scripting

importance of /var/mail

Hi When an entry will be made to the file /var/mail/<user-id> . I have 100 scripts under a specific user id(dgircc) in cron .SO inrder to check the whether the script has sucessfully run or not and if not to generate an email if i mention the code like #!/bin/ksh -p 2 fsize=`ls -lrt... (0 Replies)
Discussion started by: mskalyani
0 Replies

9. Shell Programming and Scripting

PHP Mail Script Takes Hours to Send emails

guys, i have a php script that i wrote that takes hours to send emails to recipients. i can't post the content of this script in here because the script contains some very important confidential information. so my question is, why is it that when the php script runs, it runs successfully, but... (3 Replies)
Discussion started by: SkySmart
3 Replies

10. UNIX for Advanced & Expert Users

[SOLVED] Root mail going to user "mail" instead of root

I running Linux Mint Debian Edition tracking testing and have started a cron job that will send something to the root mailbox. Mint has heirloom and exim4 installed. However, mail was getting nothing. I realized that in /etc/aliases, there was a line root: mintSince you can't log into the mint... (0 Replies)
Discussion started by: Narnie
0 Replies
mbox(5) 							File Formats Manual							   mbox(5)

NAME
mbox - file containing mail messages INTRODUCTION
The most common format for storage of mail messages is mbox format. An mbox is a single file containing zero or more mail messages. MESSAGE FORMAT
A message encoded in mbox format begins with a From_ line, continues with a series of non-From_ lines, and ends with a blank line. A From_ line means any line that begins with the characters F, r, o, m, space: From god@heaven.af.mil Sat Jan 3 01:05:34 1996 Return-Path: <god@heaven.af.mil> Delivered-To: djb@silverton.berkeley.edu Date: 3 Jan 1996 01:05:34 -0000 From: God <god@heaven.af.mil> To: djb@silverton.berkeley.edu (D. J. Bernstein) How's that mail system project coming along? The final line is a completely blank line (no spaces or tabs). Notice that blank lines may also appear elsewhere in the message. The From_ line always looks like From envsender date moreinfo. envsender is one word, without spaces or tabs; it is usually the envelope sender of the message. date is the delivery date of the message. It always contains exactly 24 characters in asctime format. moreinfo is optional; it may contain arbitrary information. Between the From_ line and the blank line is a message in RFC 822 format, as described in qmail-header(5), subject to >From quoting as described below. HOW A MESSAGE IS DELIVERED
Here is how a program appends a message to an mbox file. It first creates a From_ line given the message's envelope sender and the current date. If the envelope sender is empty (i.e., if this is a bounce message), the program uses MAILER-DAEMON instead. If the envelope sender contains spaces, tabs, or newlines, the program replaces them with hyphens. The program then copies the message, applying >From quoting to each line. >From quoting ensures that the resulting lines are not From_ lines: the program prepends a > to any From_ line, >From_ line, >>From_ line, >>>From_ line, etc. Finally the program appends a blank line to the message. If the last line of the message was a partial line, it writes two newlines; oth- erwise it writes one. HOW A MESSAGE IS READ
A reader scans through an mbox file looking for From_ lines. Any From_ line marks the beginning of a message. The reader should not attempt to take advantage of the fact that every From_ line (past the beginning of the file) is preceded by a blank line. Once the reader finds a message, it extracts a (possibly corrupted) envelope sender and delivery date out of the From_ line. It then reads until the next From_ line or end of file, whichever comes first. It strips off the final blank line and deletes the quoting of >From_ lines and >>From_ lines and so on. The result is an RFC 822 message. COMMON MBOX VARIANTS
There are many variants of mbox format. The variant described above is mboxrd format, popularized by Rahul Dhesi in June 1995. The original mboxo format quotes only From_ lines, not >From_ lines. As a result it is impossible to tell whether From: djb@silverton.berkeley.edu (D. J. Bernstein) To: god@heaven.af.mil >From now through August I'll be doing beta testing. Thanks for your interest. was quoted in the original message. An mboxrd reader will always strip off the quoting. mboxcl format is like mboxo format, but includes a Content-Length field with the number of bytes in the message. mboxcl2 format is like mboxcl but has no >From quoting. These formats are used by SVR4 mailers. mboxcl2 cannot be read safely by mboxrd readers. UNSPECIFIED DETAILS
There are many locking mechanisms for mbox files. qmail-local always uses flock on systems that have it, otherwise lockf. The delivery date in a From_ line does not specify a time zone. qmail-local always creates the delivery date in GMT so that mbox files can be safely transported from one time zone to another. If the mtime on a nonempty mbox file is greater than the atime, the file has new mail. If the mtime is smaller than the atime, the new mail has been read. If the atime equals the mtime, there is no way to tell whether the file has new mail, since qmail-local takes much less than a second to run. One solution is for a mail reader to artificially set the atime to the mtime plus 1. Then the file has new mail if and only if the atime is less than or equal to the mtime. Some mail readers place Status fields in each message to indicate which messages have been read. SEE ALSO
maildir(5), qmail-header(5), qmail-local(8) mbox(5)
All times are GMT -4. The time now is 04:56 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy